diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 18a508d..a8c3de9 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -4659,8 +4659,10 @@
             if( ssl->nb_zero > 3 )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
-                                    "messages, possible DoS attack" ) );
-                /* Q: Is that the right error code? */
+                                            "messages, possible DoS attack" ) );
+                /* Treat the records as if they were not properly authenticated,
+                 * thereby failing the connection if we see more than allowed
+                 * by the configured bad MAC threshold. */
                 return( MBEDTLS_ERR_SSL_INVALID_MAC );
             }
         }